FINMA Sets Strict Custody Rules for Cryptocurrencies: New Swiss Regulatory Guidelines

The Swiss Financial Market Supervisory Authority (FINMA) has issued new guidelines on the custody of digital assets, detailing the key operational, legal, and counterparty risks associated with holding such assets. The directive also sets clear expectations for banks, asset managers, and issuers of financial products, aiming to strengthen investor protection and support overall market stability.

In this context, FINMA published Directive 2026/1 on January 12, focusing on the custody of digital currencies within the banking sector, portfolio management, and the offering of financial products. The directive further addresses disclosure obligations to investors, in accordance with applicable Swiss financial laws.

FINMA emphasized that digital assets continue to carry high levels of risk, highlighting the need for institutions to manage them with the same rigor and precision applied to traditional assets. These assets are exposed to unique operational risks, including cyberattacks, loss of private keys, and technical failures. Since digital assets are stored on blockchain networks, secure and effective key management is essential to ensure access and protection.

Counterparty risk is another critical concern, particularly when custody is delegated to third parties. In cases of custodian insolvency, asset segregation may not be guaranteed—especially when these entities are located outside Switzerland or lack adequate prudential oversight. FINMA further noted that such risks are exacerbated by weak regulatory or legal frameworks in certain jurisdictions.

Moreover, FINMA underscored the risks associated with price volatility, explaining that cryptocurrencies are prone to sharp fluctuations. Stablecoins can mitigate some of these risks only if they are fully backed by verifiable, real-world assets.

Regarding the management of individual investment portfolios, FINMA requires that digital assets be held with separate custodians, such as banks, securities firms, or institutions subject to equivalent supervision. This requirement applies to both domestic and foreign custodians. Portfolio managers must perform thorough due diligence before entering into custody agreements and continuously monitor the arrangements. All procedures must be documented within institutional policies to ensure ongoing regulatory compliance.

However, FINMA allows limited exceptions in specific cases. Portfolio managers may engage custodians with less than full supervisory equivalence, provided that clients are fully informed of the risks and give explicit written consent. The authority emphasized that regulatory requirements cannot be bypassed through the use of foreign structures.

For Swiss collective investment funds, digital assets must be held with a Swiss depositary bank. Custody can only be delegated to third parties if they provide supervision and insolvency protection equivalent to local standards. FINMA clarified that existing rules under the Collective Investment Funds Act fully apply to digital assets, requiring that investors be informed of custody risks through prospectuses and key information documents.

As for structured products based on digital currencies and exchange-traded products, these are governed by the Financial Services Act. The authority noted that Swiss exchanges, including SIX and BX, already implement specific custodianship requirements for cryptocurrency-based ETPs, and these regulatory frameworks will remain unchanged under the new guidelines.

In conclusion, FINMA stressed that cryptocurrency-based assets remain speculative and volatile, even when all custody requirements are met. The authority highlighted the importance of clear and transparent disclosures to investors, including potential risks of significant losses. Transparent communication is essential to maintain market integrity, ensuring that investors fully understand the custody, volatility, and bankruptcy risks before engaging with digital asset investments.